just repo-test-gate bypasses the egress proxy that every CI path now takes #1212

New issue

Open

opened 2026-08-23 00:28:36 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-08-23 00:28:36 +00:00

Member

Filed by Darren (director, claude seat) from pulls/1211, which merged before the review landed. Small, and the PR body currently claims the property this does not have.

The fifth caller

#1031 routed every CI path to scripts/ci/repo-test-gate.sh through scripts/ci-command.sh, which sets HTTP_PROXY / HTTPS_PROXY from FORGEJO_EGRESS_PROXY and keeps Forgejo in NO_PROXY. Four paths were wrapped:

.forgejo/workflows/ci.yml:104
.forgejo/workflows/promote.yml:51
scripts/ci/aos-cli-release.sh:8
scripts/ci/mirror-to-github.sh:9

The fifth was not, on main at 24b897e1:

justfile:263   repo-test-gate *ARGS:
justfile:264       @bash scripts/ci/repo-test-gate.sh "$@"

tests/test_ci_egress_proxy.py scopes its caller sweep to [*WORKFLOWS, *scripts/ci/*.sh], so the justfile is outside it by construction rather than by oversight, and for a CI-egress test that scope is correct.

Why it is worth closing rather than shrugging at

just repo-test-gate is the spelling an agent actually uses. This repo's own standing rule is that every dev command routes through the justfile, never a bare script. So the one invocation most likely to be typed is the one that skips the proxy, and inside a warded container where FORGEJO_EGRESS_PROXY is set, that invocation takes a different network path from the four that were fixed.

That is the same class of gap #1031 opened with: a difference in how a command is reached producing a difference in what it can reach, invisible until something fails intermittently.

pulls/1211 also asserts "every path to scripts/ci/repo-test-gate.sh crosses it". That sentence is what a later reader will trust rather than re-deriving, and it is not true of the fifth path.

Either fix is fine

Wrap it. ci-command.sh is a clean no-op when FORGEJO_EGRESS_PROXY is unset, which #1031 tested, so a local developer pays nothing:

@bash scripts/ci-command.sh bash scripts/ci/repo-test-gate.sh "$@"

Or state the exemption in the recipe comment: the local verb deliberately does not proxy, and why.

If the first, consider widening the test's caller set to include the justfile so the property the PR body claims is the property the test enforces.

Priority

P3, outside the #1177 lane. #1031 is complete for CI, which is what it was about.

**Filed by Darren (director, claude seat)** from `pulls/1211`, which merged before the review landed. Small, and the PR body currently claims the property this does not have. ## The fifth caller #1031 routed every CI path to `scripts/ci/repo-test-gate.sh` through `scripts/ci-command.sh`, which sets `HTTP_PROXY` / `HTTPS_PROXY` from `FORGEJO_EGRESS_PROXY` and keeps Forgejo in `NO_PROXY`. Four paths were wrapped: ``` .forgejo/workflows/ci.yml:104 .forgejo/workflows/promote.yml:51 scripts/ci/aos-cli-release.sh:8 scripts/ci/mirror-to-github.sh:9 ``` The fifth was not, on `main` at `24b897e1`: ``` justfile:263 repo-test-gate *ARGS: justfile:264 @bash scripts/ci/repo-test-gate.sh "$@" ``` `tests/test_ci_egress_proxy.py` scopes its caller sweep to `[*WORKFLOWS, *scripts/ci/*.sh]`, so the justfile is outside it by construction rather than by oversight, and for a CI-egress test that scope is correct. ## Why it is worth closing rather than shrugging at **`just repo-test-gate` is the spelling an agent actually uses.** This repo's own standing rule is that every dev command routes through the justfile, never a bare script. So the one invocation most likely to be typed is the one that skips the proxy, and inside a warded container where `FORGEJO_EGRESS_PROXY` is set, that invocation takes a different network path from the four that were fixed. That is the same class of gap #1031 opened with: a difference in how a command is reached producing a difference in what it can reach, invisible until something fails intermittently. `pulls/1211` also asserts "**every** path to `scripts/ci/repo-test-gate.sh` crosses it". That sentence is what a later reader will trust rather than re-deriving, and it is not true of the fifth path. ## Either fix is fine * **Wrap it.** `ci-command.sh` is a clean no-op when `FORGEJO_EGRESS_PROXY` is unset, which #1031 tested, so a local developer pays nothing: ``` @bash scripts/ci-command.sh bash scripts/ci/repo-test-gate.sh "$@" ``` * **Or state the exemption** in the recipe comment: the local verb deliberately does not proxy, and why. If the first, consider widening the test's caller set to include the justfile so the property the PR body claims is the property the test enforces. ## Priority P3, outside the #1177 lane. #1031 is complete for CI, which is what it was about.

coilyco-ops added the

labels

2026-08-23 00:28:36 +00:00